This discussion has been locked.

You can no longer post new replies to this discussion. If you have a question you can start a new discussion

Site to Site IPSEC VPN Timeout

Hello,

I am new to IPSEC VPN.

In my scenario there is IPSEC Site to site VPN.

Only End B side users access Servers located at Site A.

At End B,There is time out issue with application.

How can i increase that idle timeout with Sophos 9.107-33

IKE SA Lifetime > 7800
IPSEC SA Lifetime > 3600

Pls help to resolve this.

This thread was automatically locked due to age.

0 kautilya over 10 years ago

On Advanced TAB > Dead peer detection is tick marked.
Cancel
Vote Up 0 Vote Down

Cancel
0 Scott_Klassen over 10 years ago

As long as you have a paid license, I highly suggest that you contact support for this issue. There is a way of adjusting from the backend, but if you do it yourself (without support blessing) and something goes wrong, you lose support and warranty until you do a re-install to remove the changes completely. If this one application is timing out but the tunnel is still active and passing traffic, then adjusting timeouts/lifetimes for the tunnel may not be the solution. We'd really need to know more specifics.

Also, given the large number of issues you've been experiencing this month, you want to get your reseller involved in providing you some assistance.

__________________
ACE v8/SCA v9.3

...still have a v5 install disk in a box somewhere.

http://xkcd.com
http://www.tedgoff.com/mb
http://www.projectcartoon.com/cartoon/1
Cancel
Vote Up 0 Vote Down

Cancel
0 apijnappels over 10 years ago

IKE SA Lifetime > 7800
IPSEC SA Lifetime > 3600

You do have the same values on both sides of the IPSEC connection do you?
For other troubles follow Scott_Klassen's advice...

Managing several Sophos UTMs and Sophos XGs both at work and at some home locations, dedicated to continuously improve IT-security and feeling well helping others with their IT-security challenges.

Sometimes I post some useful tips on my blog, see blog.pijnappels.eu/category/sophos/ for Sophos related posts.
Cancel
Vote Up 0 Vote Down

Cancel
0 BeanAnimal over 10 years ago in reply to apijnappels

Maybe another candidate for Anti Replay issues?
Cancel
Vote Up 0 Vote Down

Cancel
0 kautilya over 10 years ago in reply to BeanAnimal

Thx a lot to all...

Yeah have configured same value.

i do not understand this anti replay issue.

can you pls guide me.
Cancel
Vote Up 0 Vote Down

Cancel
0 kautilya over 10 years ago in reply to kautilya

I have changed timers to 86400 but still getting error "Connection reset by peer".

Pls suggest.

Thx in advance
Cancel
Vote Up 0 Vote Down

Cancel
0 kautilya over 10 years ago in reply to kautilya

Hello Folks,

i have enabled

Ipsec Site to Site VPN > Remote Gateway >Edit > Advanced > Support Path MTU Discovery.

This one resolved my issue.

Can any one pls explain me abt this technically in brief.

Need more clearance.
Cancel
Vote Up 0 Vote Down

Cancel
0 Scott_Klassen over 10 years ago

Support path MTU discovery: PMTU (Path Maximum Transmission Unit) refers to the size of data packets transmitted. It is usually preferable that IP data packets be of the largest size that does not require fragmentation anywhere along the path from the source to the destination. If any of the data packets are too large to be forwarded without fragmentation by some router along the path, that router will discard them and return ICMP Destination Unreachable messages with a code meaning "fragmentation needed and DF set". Upon receipt of such a message, the source host reduces its assumed PMTU for the path.
If you enable this option, UTM enables PMTU if it is enabled on the server side.
There must have been an MTU mismatch.

__________________
ACE v8/SCA v9.3

...still have a v5 install disk in a box somewhere.

http://xkcd.com
http://www.tedgoff.com/mb
http://www.projectcartoon.com/cartoon/1
Cancel
Vote Up 0 Vote Down

Cancel
0 kautilya over 10 years ago in reply to Scott_Klassen

Again complain from other side.

I think i have to check with Sonic wall TCP Connection time out inactively.

Will check and share.
Cancel
Vote Up 0 Vote Down

Cancel
0 kautilya over 10 years ago in reply to kautilya

It is Sonicwall Bug,

Reolved with vpn > lan and lan > vpn policy with timeout settings.
Cancel
Vote Up 0 Vote Down

Cancel